An archived reproduction of Microsoft’s administrative notice MC1537494 says Microsoft plans to make Defender role-based access control (Defender RBAC) the single permissions model for in-scope Microsoft Defender and Microsoft Sentinel portal experiences. The global rollout is scheduled for early December 2026 through late January 2027. For each tenant, the Defender portal identifies the workloads and activation dates; automatic activation is expected about 30 days after that tenant’s notification, according to the archived notice.
Review imported roles before activation
The notice describes a staged change: existing role assignments will be imported for review, then the specified workloads will activate Defender RBAC. The import itself has no operational impact before activation.
Administrators can review and adjust assignments and scopes in Defender portal > Permissions > Roles before a workload activates. The notice also says administrators can run the import again manually. The tenant’s portal notice supplies the applicable workloads and dates, so that is the schedule to use when planning the review.
Plan the role review around the activation dates shown in your tenant’s Defender portal, not just the global rollout window.
How Defender, Sentinel and Azure permissions fit together
Defender RBAC covers the in-scope Defender and Sentinel portal experiences. Sentinel workspace permissions move into that model, while Azure RBAC continues to govern Azure resources such as Logic Apps and Workbooks.
| Permission area | System or treatment described | Practical scope |
| Defender and Sentinel portal experiences | Defender RBAC activates for the workloads named in the tenant’s notice | Portal access for those in-scope workloads |
| Sentinel workspace roles | Sentinel Reader, Sentinel Responder and Sentinel Contributor permissions are included in the transition | Workspace permissions move into Defender RBAC |
| Azure resources | Azure RBAC continues to apply | Includes resources such as Logic Apps and Workbooks |
| Microsoft Entra directory roles | Continue to grant Defender portal access and map to Defender RBAC permissions | Directory roles remain part of the access arrangement |
| B2B/GDAP delegated access | Delegated and multi-tenant management remain unchanged; assigned roles are included in the import | Existing delegated role assignments are brought into the review |
For administrators managing both Sentinel and Azure resources, the key operational distinction is the permission’s scope: Sentinel workspace roles are included in the change, while Azure RBAC still governs the Azure resources named in the notice.
Other permission boundaries
The notice says Microsoft Purview, Exchange Online, Privileged Identity Management (PIM), and Azure resource permissions unrelated to Sentinel remain unchanged. Microsoft Defender for Office 365 is in scope for Plan 2, whether licensed separately or included in an eligible suite such as Microsoft 365 E5. PowerShell management for Defender for Office 365 continues as before.
After a workload activates Defender RBAC, administrators can use its workload settings to opt out and return that workload to the legacy permissions model. Administrators who configure roles and permissions through APIs are directed to move to the Defender RBAC API.
